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Rkcorp of Interview 

The applicants would like to thank Examiner Ronald Baum for his helpful 
comments and suggestions during the telephone interview with the undersigned and 
associate attorney Wendell Peete on December 14, 2005. During the telephone interview 
certain aspects of novelty over the cited art were discussed. 

Pursuant to 37 C.F.R. § 1 .133(b), the following description is submitted as a 
complete written statement of the reasons presented at the interview as warranting 
favorable action* The following statement is intended to comply vydth the requirements of 
MPEP § 713,04 and expressly sets forth: (A) a brief description of the nature any exhibit 
shown or any demonstration conducted; (B) identification of the claims discussed; (C) 
identification of specific prior art discussed; (D) identification of the principal proposed 
amendments of a substantive nature discussed; (E) the general thrust of the principal 
arguments; and (F) a general indication of any other perdnent matters; and (G) the 
general results or outcome of the interview, if appropriate. 

(A) No exhibits were shown or discussed. 

(B) The independent claims were discussed, in particular certain aspects relating 
to flow-based detection of network intrusions. 

(C) The Shipley (6,1 19,236) patent was discussed- 

(D) No proposed amendments were officially presented or discussed, but the 
claim amendments presented in this paper are consistent with the discussion. 

(E) The general thrust of the discussion was as set forth below in the next 
paragraphs. 

(F) No other matters were discussed. 

(G) No agreement was reached during the interview regarding the claims. 

The general thrust of the discussion was that the Shipley patent did not disclose, 
teach, or suggest the claimed aspects of a flow-based detection of suspicious network 
activity such as intrusions. As discussed, and among other aspects, the claimed 
invention(s) provide for detection of suspicious network activity based on the monitoring 
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of packets betureen two hosts on a networic that are associated with a single service, and 
characterizing a group of such packets as a "flow." 

The examiner suggested that the claims be amended to more particularly specify 
what a flow is and how the flows are used to determine the recited "concern index," No 
agreement on particular claim language was reached, pending submission of a formal 
amendment. 

The amendments herein and comments that follow are intended to be consistent 
with the remarks made during the interview. 

In the event that the foregoing record is not considered complete and accurate, the 
Examiner is respectfully requested to bring any incompleteness or inaccuracy to the 
attention of the undersigned 
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